MC-36035: Prevent input based resource allocation

- Fixed web-api

Author: hwyu@adobe.com

app/etc/di.xml

@@ -1959,4 +1959,9 @@
             <argument name="maxPageSize" xsi:type="number">300</argument>
         </arguments>
     </type>
+    <type name="Magento\Framework\Webapi\ServiceInputProcessor">
+        <arguments>
+            <argument name="defaultPageSize" xsi:type="number">20</argument>
+        </arguments>
+    </type>
 </config>

lib/internal/Magento/Framework/Webapi/ServiceInputProcessor.php

@@ -92,6 +92,11 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
      */
     private $serviceInputValidator;
 
+    /**
+     * @var int
+     */
+    private $defaultPageSize;
+
     /**
      * Initialize dependencies.
      *
@@ -104,6 +109,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
      * @param ConfigInterface|null $config
      * @param array $customAttributePreprocessors
      * @param ServiceInputValidatorInterface|null $serviceInputValidator
+     * @param int|null $defaultPageSize
      */
     public function __construct(
         TypeProcessor $typeProcessor,
@@ -114,7 +120,8 @@ public function __construct(
         ServiceTypeToEntityTypeMap $serviceTypeToEntityTypeMap = null,
         ConfigInterface $config = null,
         array $customAttributePreprocessors = [],
-        ServiceInputValidatorInterface $serviceInputValidator = null
+        ServiceInputValidatorInterface $serviceInputValidator = null,
+        int $defaultPageSize = null
     ) {
         $this->typeProcessor = $typeProcessor;
         $this->objectManager = $objectManager;
@@ -128,6 +135,7 @@ public function __construct(
         $this->customAttributePreprocessors = $customAttributePreprocessors;
         $this->serviceInputValidator = $serviceInputValidator
             ?: ObjectManager::getInstance()->get(ServiceInputValidatorInterface::class);
+        $this->defaultPageSize = $defaultPageSize ?: 20;
     }
 
     /**
@@ -304,7 +312,7 @@ protected function _createFromArray($className, $data)
         if ($object instanceof SearchCriteriaInterface
             && $object->getPageSize() === null
         ) {
-            $object->setPageSize(20);
+            $object->setPageSize($this->defaultPageSize);
         }
 
         return $object;